From 311abb933a0cb8ae200b024bb669fa40697e9332 Mon Sep 17 00:00:00 2001 From: Dr Jones Date: Thu, 21 May 2026 23:58:48 -0700 Subject: [PATCH] =?UTF-8?q?chore:=20tie=20loose=20ends=20=E2=80=94=20wirin?= =?UTF-8?q?g,=20imports,=20gitignore,=20dep=20audit?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .gitignore | 2 ++ docs/OPERATOR_RUNBOOK.md | 9 +++++++++ 2 files changed, 11 insertions(+) diff --git a/.gitignore b/.gitignore index adddbd7..c1e3ba0 100644 --- a/.gitignore +++ b/.gitignore @@ -21,3 +21,5 @@ signup_draft.json *.png *.jpg *.jpeg +# Exceptions — keep bundled assets that are already tracked +!proxy_chain_manager/world_map.png diff --git a/docs/OPERATOR_RUNBOOK.md b/docs/OPERATOR_RUNBOOK.md index 2a8b508..68dce5d 100644 --- a/docs/OPERATOR_RUNBOOK.md +++ b/docs/OPERATOR_RUNBOOK.md @@ -36,6 +36,15 @@ Restart-Service -Name MpsSvc -Force This resets all runtime firewall state (not persistent rules). You may still need to remove the `PCM_*` rules afterward with Option 1. +### How the application handles this automatically + +`firewall.py` exposes `emergency_disengage()`, which is registered via +`atexit` and `signal.SIGTERM`/`SIGINT` in `service.py`. A clean exit or +SIGTERM will call `emergency_disengage()` automatically, removing all +`PCM_*` rules and restoring `allowoutbound` before the process terminates. +Only a hard kill (`SIGKILL`, power loss, BSOD) can bypass this handler — +in those cases use Option 1 or Option 2 above. + ### Verify rules are gone ```powershell